Add PR bundle-size comments workflow

.github/workflows/changeset-reporter.yml

@@ -20,7 +20,7 @@ jobs:
       pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
     runs-on: ubuntu-latest
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           persist-credentials: false

.github/workflows/pr-changeset-review.yml

@@ -26,7 +26,7 @@ jobs:
     name: vale
     runs-on: ubuntu-latest
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           persist-credentials: false

.github/workflows/pr-check-changeset.yml

@@ -22,18 +22,18 @@ jobs:
     runs-on: ubuntu-latest
     if: contains(github.event.pull_request.labels.*.name, 'changeset-required')
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           fetch-depth: "0" # all history
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }} # Check out the head commit, not the merge commit
 
       # install and configure node, pnpm and the changeset tools
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version-file: .nvmrc

.github/workflows/pr-release-branch-warning.yml

@@ -21,7 +21,7 @@ jobs:
       pull-requests: write # for marocchino/sticky-pull-request-comment to create or update PR comment
     runs-on: ubuntu-latest
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           persist-credentials: false

.github/workflows/pr-validation.yml

@@ -19,7 +19,7 @@ jobs:
     name: Validate CODEOWNERS
     runs-on: ubuntu-latest
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           persist-credentials: false

.github/workflows/push-tag-create-release.yml

@@ -35,10 +35,10 @@ jobs:
           fetch-depth: "0" # all history, including tags
           persist-credentials: false
 
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version-file: .nvmrc

.github/workflows/release-approval.yml

@@ -114,7 +114,7 @@ jobs:
           status: pending
           context: Check PR approval
 
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           # The default ref when triggered by the workflow_run event is the default branch -- main
@@ -123,10 +123,10 @@ jobs:
           submodules: false
 
       # install and configure node, pnpm and the changeset tools
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version-file: .nvmrc

.github/workflows/release-notes-issue.yml

@@ -29,16 +29,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Check out the repo and set up node and pnpm.
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           fetch-depth: "100"
           persist-credentials: false
 
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version-file: .nvmrc

.github/workflows/website-validation.yml

@@ -26,15 +26,15 @@ jobs:
     runs-on: ubuntu-latest
     name: Build site
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           submodules: false
 
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version: "22"
@@ -60,15 +60,15 @@ jobs:
     runs-on: ubuntu-latest
     name: pnpm lint
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           submodules: false
 
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version: "22"
@@ -85,15 +85,15 @@ jobs:
     name: 🧪 Website Tests
     needs: build_site
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           submodules: false
 
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version: "22"
@@ -118,15 +118,15 @@ jobs:
     name: 🔗 Broken Link Check
     needs: build_site
     steps:
-      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/checkout/releases/tag/v6.0.2
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
         with:
           submodules: false
 
-      # release notes: https://github.com/pnpm/action-setup/releases/tag/v4.2.0
+      # release notes: https://github.com/pnpm/action-setup/releases/tag/v5.0.0
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # ratchet:pnpm/action-setup@v5
 
-      # release notes: https://github.com/actions/setup-node/releases/tag/v6.0.0
+      # release notes: https://github.com/actions/setup-node/releases/tag/v6.3.0
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6
         with:
           node-version: "22"

build-tools/packages/build-cli/docs/report.md

@@ -4,6 +4,7 @@
 Report analysis about the codebase, like code coverage and bundle size measurements.
 
 * [`flub report codeCoverage`](#flub-report-codecoverage)
+* [`flub report comparePipelineBundleArtifacts`](#flub-report-comparepipelinebundleartifacts)
 
 ## `flub report codeCoverage`
 
@@ -39,3 +40,31 @@ DESCRIPTION
 ```
 
 _See code: [src/commands/report/codeCoverage.ts](https://github.com/microsoft/FluidFramework/blob/main/build-tools/packages/build-cli/src/commands/report/codeCoverage.ts)_
+
+## `flub report comparePipelineBundleArtifacts`
+
+Download ADO bundle-size artifacts for two commits and emit their per-package, per-bundle differences as JSON. Base-side artifacts come from the `Build - Client bundle size artifacts` pipeline (runs on main/release pushes); head-side artifacts come from the `Build - client packages` pipeline (runs on PR commits). Intended for the PR-comment CI workflow; for local inner-dev-loop comparisons use `check bundleSize` instead.
+
+```
+USAGE
+  $ flub report comparePipelineBundleArtifacts --base <value> --head <value> [--json] [-v | --quiet]
+
+FLAGS
+  --base=<value>  (required) Base commit SHA — the merge-base on the target branch. The baseline of the comparison.
+  --head=<value>  (required) Head commit SHA — the PR's tip. The compare side of the comparison.
+
+LOGGING FLAGS
+  -v, --verbose  Enable verbose logging.
+      --quiet    Disable all logging.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Download ADO bundle-size artifacts for two commits and emit their per-package, per-bundle differences as JSON.
+  Base-side artifacts come from the `Build - Client bundle size artifacts` pipeline (runs on main/release pushes);
+  head-side artifacts come from the `Build - client packages` pipeline (runs on PR commits). Intended for the PR-comment
+  CI workflow; for local inner-dev-loop comparisons use `check bundleSize` instead.
+```
+
+_See code: [src/commands/report/comparePipelineBundleArtifacts.ts](https://github.com/microsoft/FluidFramework/blob/main/build-tools/packages/build-cli/src/commands/report/comparePipelineBundleArtifacts.ts)_

build-tools/packages/build-cli/src/commands/check/bundleSize.ts

@@ -6,9 +6,11 @@
 import { execFileSync } from "node:child_process";
 import { Flags } from "@oclif/core";
 
+import { fluidframeworkAdoOrgUrl } from "../../library/azureDevops/constants.js";
 import { getArtifactForCommit } from "../../library/azureDevops/getArtifactForCommit.js";
 import { getAzureDevopsApi } from "../../library/azureDevops/getAzureDevopsApi.js";
 import {
+	bundleSizeArtifactsBaselinePipeline,
 	compareJsonReportsByPackage,
 	extractAnalyzerJsonsFromArtifact,
 	type PackageComparison,
@@ -40,7 +42,7 @@ function formatComparison(comparison: PackageComparison): string[] {
 	const fmt = (before: number, after: number): string => {
 		const delta = after - before;
 		const sign = delta > 0 ? "+" : "";
-		return `${before} -> ${after} (${sign}${delta})`;
+		return `${before} → ${after} (${sign}${delta})`;
 	};
 
 	const lines: string[] = [];
@@ -129,16 +131,13 @@ export default class CheckBundleSize extends BaseCommand<typeof CheckBundleSize>
 		this.log(`Baseline commit: ${baselineCommit}`);
 
 		// Public ADO project — anonymous reads are fine at this command's scale.
-		const adoApi = getAzureDevopsApi(undefined, "https://dev.azure.com/fluidframework");
+		const adoApi = getAzureDevopsApi(undefined, fluidframeworkAdoOrgUrl);
 		const artifactContents = await getArtifactForCommit({
 			adoApi,
-			// Published by the `Build - Client bundle size artifacts` pipeline.
-			artifactName: "bundleAnalyzerJson",
-			commit: baselineCommit,
-			// `Build - Client bundle size artifacts` in the `public` project.
-			// Source-of-truth: tools/pipelines/build-bundle-size-artifacts.yml.
-			definitionId: 48,
-			project: "public",
+			artifactName: bundleSizeArtifactsBaselinePipeline.bundleAnalyzerJsonArtifactName,
+			match: { kind: "commit", sha: baselineCommit },
+			definitionId: bundleSizeArtifactsBaselinePipeline.definitionId,
+			project: bundleSizeArtifactsBaselinePipeline.project,
 		});
 
 		const baselineJsons = extractAnalyzerJsonsFromArtifact(artifactContents);

build-tools/packages/build-cli/src/commands/report/codeCoverage.ts

@@ -10,7 +10,10 @@ import {
 	isCodeCoverageCriteriaPassed,
 } from "../../codeCoverage/compareCodeCoverage.js";
 import { getCommentForCodeCoverageDiff } from "../../codeCoverage/getCommentForCodeCoverage.js";
-import type { IAzureDevopsBuildCoverageConstants } from "../../library/azureDevops/constants.js";
+import {
+	fluidframeworkAdoOrgUrl,
+	type IAzureDevopsBuildCoverageConstants,
+} from "../../library/azureDevops/constants.js";
 import { BaseCommand } from "../../library/commands/base.js";
 import {
 	createOrUpdateCommentOnPr,
@@ -78,7 +81,7 @@ export default class ReportCodeCoverageCommand extends BaseCommand<
 
 		const artifactNamePrefix = "Code Coverage Report";
 		const codeCoverageConstantsForBaseline: IAzureDevopsBuildCoverageConstants = {
-			orgUrl: "https://dev.azure.com/fluidframework",
+			orgUrl: fluidframeworkAdoOrgUrl,
 			projectName: "public",
 			ciBuildDefinitionId: flags.adoCIBuildDefinitionIdBaseline,
 			artifactName: artifactNamePrefix,
@@ -87,7 +90,7 @@ export default class ReportCodeCoverageCommand extends BaseCommand<
 		};
 
 		const codeCoverageConstantsForPR: IAzureDevopsBuildCoverageConstants = {
-			orgUrl: "https://dev.azure.com/fluidframework",
+			orgUrl: fluidframeworkAdoOrgUrl,
 			projectName: "public",
 			ciBuildDefinitionId: flags.adoCIBuildDefinitionIdPR,
 			artifactName: artifactNamePrefix,

build-tools/packages/build-cli/src/commands/report/comparePipelineBundleArtifacts.ts

@@ -0,0 +1,84 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { Flags } from "@oclif/core";
+
+import { fluidframeworkAdoOrgUrl } from "../../library/azureDevops/constants.js";
+import { getArtifactForCommit } from "../../library/azureDevops/getArtifactForCommit.js";
+import { getAzureDevopsApi } from "../../library/azureDevops/getAzureDevopsApi.js";
+import {
+	bundleSizeArtifactsBaselinePipeline,
+	bundleSizeArtifactsPrPipeline,
+	compareJsonReportsByPackage,
+	extractAnalyzerJsonsFromArtifact,
+	type PackageComparison,
+} from "../../library/bundleSize/index.js";
+import { BaseCommand } from "../../library/commands/base.js";
+
+/**
+ * Result serialized to stdout by `--json`.
+ */
+interface ComparePipelineBundleArtifactsResult {
+	baseCommit: string;
+	headCommit: string;
+	comparison: PackageComparison;
+}
+
+export default class ComparePipelineBundleArtifacts extends BaseCommand<
+	typeof ComparePipelineBundleArtifacts
+> {
+	static readonly description =
+		`Download ADO bundle-size artifacts for two commits and emit their per-package, per-bundle differences as JSON. Base-side artifacts come from the \`Build - Client bundle size artifacts\` pipeline (runs on main/release pushes); head-side artifacts come from the \`Build - client packages\` pipeline (runs on PR commits). Intended for the PR-comment CI workflow; for local inner-dev-loop comparisons use \`check bundleSize\` instead.`;
+
+	static readonly enableJsonFlag = true;
+
+	static readonly flags = {
+		base: Flags.string({
+			description:
+				"Base commit SHA — the merge-base on the target branch. The baseline of the comparison.",
+			required: true,
+		}),
+		head: Flags.string({
+			description: "Head commit SHA — the PR's tip. The compare side of the comparison.",
+			required: true,
+		}),
+		...BaseCommand.flags,
+	} as const;
+
+	public async run(): Promise<ComparePipelineBundleArtifactsResult> {
+		const { base, head } = this.flags;
+
+		// Public ADO project — anonymous reads are fine at this command's scale.
+		const adoApi = getAzureDevopsApi(undefined, fluidframeworkAdoOrgUrl);
+
+		const baseArtifact = await getArtifactForCommit({
+			adoApi,
+			artifactName: bundleSizeArtifactsBaselinePipeline.bundleAnalyzerJsonArtifactName,
+			match: { kind: "commit", sha: base },
+			definitionId: bundleSizeArtifactsBaselinePipeline.definitionId,
+			project: bundleSizeArtifactsBaselinePipeline.project,
+		});
+		const baseJsons = extractAnalyzerJsonsFromArtifact(baseArtifact);
+		if (baseJsons.size === 0) {
+			this.error(`Base artifact contains no analyzer.json files for commit ${base}.`);
+		}
+
+		const headArtifact = await getArtifactForCommit({
+			adoApi,
+			artifactName: bundleSizeArtifactsPrPipeline.bundleAnalyzerJsonArtifactName,
+			match: { kind: "prHead", sha: head },
+			definitionId: bundleSizeArtifactsPrPipeline.definitionId,
+			project: bundleSizeArtifactsPrPipeline.project,
+		});
+		const headJsons = extractAnalyzerJsonsFromArtifact(headArtifact);
+		if (headJsons.size === 0) {
+			this.error(`Head artifact contains no analyzer.json files for commit ${head}.`);
+		}
+
+		const comparison = compareJsonReportsByPackage(baseJsons, headJsons);
+
+		return { baseCommit: base, headCommit: head, comparison };
+	}
+}

build-tools/packages/build-cli/src/library/azureDevops/constants.ts

@@ -3,6 +3,9 @@
  * Licensed under the MIT License.
  */
 
+/** ADO organization URL hosting Fluid Framework's pipelines. */
+export const fluidframeworkAdoOrgUrl = "https://dev.azure.com/fluidframework";
+
 export interface IAzureDevopsBuildCoverageConstants {
 	/**
 	 * URL for the ADO org.